Open Bug 1540645 Opened 1 year ago Updated 18 days ago

Add Web IDL constructor for signature verifier

Categories

(Core :: Security: PSM, enhancement, P3)

enhancement

Tracking

()

People

(Reporter: leplatrem, Unassigned)

References

(Blocks 1 open bug)

Details

(Whiteboard: [psm-backlog])

Attachments

(1 file)

Currently we can't execute the signature verification in a Web worker because the Web interface does not exist.

    const verifier = Cc["@mozilla.org/security/contentsignatureverifier;1"]
      .createInstance(Ci.nsIContentSignatureVerifier);

    let valid;
    try {
      valid = verifier.verifyContentSignature(
        serialized,
        builtSignature,
        certChain,
        "normandy.content-signature.mozilla.org"
      );
    }

Could become:

// worker.js

importScripts("resource://gre/modules/content-signature-verifier.js");

ContentSignatureVerifier.verifyContentSignature(
    serialized,
    builtSignature,
    certChain,
    "normandy.content-signature.mozilla.org"
);

I believe that the signature verifier relies on code that can't currently run off-main thread, so this isn't as simple as adding a definition for the interface. I think this work might already be tracked elsewhere. Dana, can you comment on this?

Flags: needinfo?(dkeeler)

Currently this would depend on figuring out the threading issues with the implementation in bug 1534600.

Depends on: 1534600
Flags: needinfo?(dkeeler)
See Also: → 1543403
See Also: → 1534600

Landing bug 1541942 removed threading restrictions, so this should be easier now (although bug 1534600 would still be helpful in that it would be nice to have an asynchronous API here).

Depends on: 1541942
Priority: -- → P3
Whiteboard: [psm-backlog]
You need to log in before you can comment on or make changes to this bug.